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Safety Requirements 

NASA’s human-rated safety requirements 

- Two-failure tolerance to catastrophic failures (JSC 20793) 


• Catastrophic for human-rating requires 

- No electrolyte venting that would cause permanent injury to crew or 
loss of vehicle or mission 


- Electrolytes that can cause permanent injury are rated as 
Toxicology level 2 for NASA human-rated missions 

• Lithium primary with an organic electrolyte and li-ion with organic 
electrolytes have a salt that is an irritant and corrrosive giving these 
electrolytes a Tox2 rating 

• The requirement therefore dictates that two-failure tolerance 
should be provided for all hazards that can lead to venting 
(electrolyte liquid), fire and thermal runaway. 

- For primary batteries this translates to two-failure tolerance to 
inadvertent charge, overdischarge into reversal, external and 
internal shorts, extreme temperatures especially high temps 

- Since no external controls exist for internal shorts, a design for 
minimum risk approach is used to mitigate that hazard. 
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Recommendations for Protective Features to 
Prevent Catastrophic Failures 

Inadvertent charge shall be prevented 


- Between parallel primary lithium cells/cell strings 

- Between primary lithium cells and other charging sources 



Cells in parallel Cell strings in 

parallel 



Redundancy in 
the case of 
mission critical 
applications 


• Overdischarge into reversal 

- Prevent unbalanced cell condition (need for cell 
matching) 

- Prevent taking cells into low voltages and/ or 
reversal 
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Recommendations for Protective Features to 
Prevent Catastrophic Failures 

External Shorts 


- High and low impedance short protection required 


- Fuses, PTCs, polyswitches, etc. shall be rated for the voltage, 
current and temperature of battery design and application as well 
as environment 
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• Internal Short 


- Stringent cell and battery level screening (OCV, CCV, dimensions, 
mass, R e ) 

- Cell matching 

- Rigorous battery flight acceptance testing that includes (vacuum) 
leak check and vibration screening with stringent pass/fail criteria for 
OCV, CCV (R e ) and mass 
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AED LiMn0 2 battery 

AED for International Space Station (ISS) Human-rated 
Application (Flown in 2008 and has been on-orbit since) 

Original Design: Ultralife 5/4 C (U10021) high-rate cells; 4 in 
series; 1 diode in parallel to each cell; 2 TCOs one between cells 
1 & 2 and one between cells 3 & 4 


12 V; 6.2 Ah 



Original AED Battery Design 
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Inadvertent Charge on Single Cell 
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Overdischarge of Unbalanced String of Four Cells 

Load: 6.9 A 
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Current (A) 


Overdischarge of Unbalanced String of Four Cells 


Load: 6.9 A 
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Overdischarge Into Reversal of Single Cell 

Load: 4.5 A 
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Voltage (V) 



Overdischarge of Unbalanced String of Four Cells 

Load: 4.5 A 



Overdischarge of Unbalanced String of Four Cells 

Load: 4.5 A 
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Heat-to-Vent Test on Single LiMn0 2 AED Cell 
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Voltage (V) 


Heat-to-Vent of Single Cell 



• Originally, the cell was in the clamp on the ring stand. 

• the cell went to the right, the feedthrough went towards the top to the left, 

• the false cover went to the bottom left, 

• the brick on the lower center was in alignment with the brick next to it (the 
bricks are 5 1/2x5 1/2x2 3/8 in.(14 x 14x6 cm) and weigh 5.8 lb (2.6 kg)) 
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Simulated Internal Short (Crush) on Single Cell 
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Voltage (V) 


External Short Circuit Test on a Single Cell 

Load : 50 mohm 
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External Short Circuit Test on a Single Cell 
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External Short on a String of Four Cells 
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External Short on a String of Four Cells 
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Summary of Test Results 


Single cell tests were benign for external short, inadvertent charge and 
overdischarge into reversal up to 4.5 A. 

- At lower current loads cells die (may be due to excessive dendrite 
formation) benignly. 

String level external short circuits lead to an unbalanced 
overdischarge, with one cell going into reversal. The result is 
catastrophic violent venting. 

Unbalanced string overdischarges at different currents causes 
catastrophic violent venting also. 

Heat-to-vent is very dramatic displaying violent venting 

Simulated internal short is also catastrophic and displays violent 
venting. 

Battery is not UL-rated; hence does not have dual-fault tolerance or 
tolerance to inherent cell tolerance to failures 
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Design Change as Recommended by NASA Battery 

Safety 

Original AED Battery Design 



NASA JSC AED Battery Design (currently on ISS) 
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Summary and Conclusions 


Single cell tests were benign for external short, inadvertent charge and 
overdischarge into reversal up to 4.5 A. 

- At lower current loads cells die (may be due to excessive dendrite 
formation) benignly. 

String level external short circuits lead to an unbalanced 
overdischarge, with one cell going into reversal. The result is 
catastrophic violent venting. 

Unbalanced string overdischarges at different currents causes 
catastrophic violent venting also. 

Heat-to-vent is very dramatic displaying violent venting 

Simulated internal short is also catastrophic and displays violent 
venting. 

Battery is not UL-rated; hence does not have dual-fault tolerance or 
tolerance to inherent cell tolerance to failures 

Battery Design for NASA JSC’s human-rated application for use on ISS 
was changed to include two bypass diodes per cell to provide for two- 
failure tolerance to overdischarge into reversal (and external short) 
hazards. 
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